Perhaps just when you thought that issues of identity theft could not become more complex, pervasive and serious, now there is another concern that may be on the horizon - and could create more issues of liability. Traditionally, criminal prosecution of identity theft may have been left to the discretion and expertise of the authorities with appropriate background on the matter provided by an affected institution. What may happen, however, if charges are brought against someone, but later dropped or dismissed? A recent case in New Jersey's appellate courts considered that question and found the banking institution, and its trained certified fraud examiner, could be found liable to an individual who claimed that he was wrongly indicted due to their allegedly inadequate investigation.
Recent reports have shown a dramatic increase in identify theft which is creating huge losses for financial institutions. The Financial Crimes Enforcement Network (FinCEN), in its Mortgage Loan Fraud Report in April 2008, compared year-to-year Suspicious Activity Reports (SARs), and found a 96 percent increase in identity theft claims in residential mortgage loans and a 214 percent increase in incidents of stolen data through computer intrusion. Similarly, the Federal Bureau of Investigation (FBI), in its 2007 Mortgage Fraud Report, published in April 2008, included identity theft in home equity lines of credit as one of its "Emerging Schemes" to watch. Indeed, in its report, the FBI found that
[a]s financial institutions begin to enforce higher lending standards, the identities of individuals with good credit will increase in value to perpetrators. [T]he continued vulnerability of identifying information will allow perpetrators the accesses necessary to commit such schemes.
Now, in addition to the cost to financial institutions from such losses, more costs may be on the horizon due to legal duties owed by banks to identity theft victims. Last month, an appellate court in New Jersey considered civil claims of malicious prosecution and negligence against a bank and its certified fraud examiner arising from a wrongful indictment of an individual who had purportedly opened a fraudulent account at the bank. The case stepped into an undeveloped area and created a legal duty of care to a non-customer where none before had existed.
In Brunson v. Affinity Federal Credit Union and Jim Wilcox , 402 N.J. Super. 430; 954 A.2d 550; 2008 N.J. Super. LEXIS 193 (2008), the Superior Court, Appellate Division, reversed summary judgment that had been entered in favor of the bank, Affinity Federal Credit Union, and its fraud examiner, Jim Wilcox. Howard Brunson claimed that the bank's fraud examiner had improperly linked Brunson to an account opened with Brunson's stolen identity.
Specifically, Brunson asserted that the bank failed to review surveillance tapes showing the individual who had opened an account in Brunson's name, using Brunson's apparently stolen social security number and a bogus New Jersey non-driver's identification card with Brunson's date of birth and address. The perpetrator deposited $25 and withdrew fraudulent checks totaling $9,506.82. The person who opened the account was identified on seven different surveillance tapes, and eyewitness descriptions stated that he was 5'6" tall. Brunson, however, was 6'3" tall. The bank's fraud examiner found that the named holder of the account, who was Brunson, had a criminal record. However, the examiner did not review photos of Brunson, which were included in his criminal record, to compare them to the person captured on the surveillance tape. Likewise, the examiner did not review Brunson's height and weight descriptions which were also included in his criminal record and compare them to the eyewitness accounts. Nonetheless, the examiner signed criminal complaints against Brunson and appeared and testified at a grand jury proceeding, which resulted in Brunson's indictment. Brunson was then arrested and jailed for 13 days until his charges were dismissed.
After his release, Brunson sued the bank and the examiner for malicious prosecution and negligent investigation, and negligent hiring of the examiner by the bank. In laying out the foregoing facts, the Superior Court noted that the fraud examiner had a "questionable basis for probable cause at best." The Superior Court then noted that the bank could be held vicariously liable for the examiner's conduct.
The Superior Court next turned to the question of whether the bank owed a duty to Brunson as the purported account holder, but who had not in fact opened the fraudulent account. The Superior Court began its analysis by reciting a laundry list of reports and data about identity theft and its growing presence and importance in the financial services economy. The Superior Court concluded that the significant concerns over identity theft may necessitate a duty of a bank to a non-customer under such circumstances. The Superior Court stated:
With the growth of identity theft both nationally and in New Jersey, it is incumbent upon financial institutions and fraud investigators to pursue with reasonable care their responsibility for protecting, not only their own customers, but non-customers who may be victims of identity theft. Fairness and public policy require financial institutions to be accountable when they negligently put individuals at risk by failing to exercise reasonable care in undertaking investigations of fraud claims.
Nonetheless, the Superior Court acknowledged that, "generally, a bank owes no duty of care to third parties who are not bank customers." However, the Superior Court then noted that sometimes tort liability of a financial institution can be established where a "special relationship has been established from which a duty can be deemed to flow." The Superior Court noted that the "question of whether a bank has a duty of reasonable care to non-customers who have been victimized by imposters has not been addressed in New Jersey." The Superior Court then turned to "other jurisdictions which have established that a bank owes a duty to non-customers to use reasonable care in opening checking accounts or extending credit." The "other jurisdictions" that the Superior Court next considered was the Alabama Supreme Court, which had decided over ten years ago the duties arising from an imposter who had opened a checking account using a non-customer's stolen identity.
In Patrick v. Union State Bank , the Alabama Supreme Court reversed the bank's dismissal and held that a "bank owes a duty of reasonable care to the person in whose name, and upon whose identification, an account is opened to ensure that the person opening the account and to whom checks are given is not an imposter." The Superior Court then noted the "special status of banks in our society" that the Alabama Supreme Court had "relied upon" and similarly found that banks in New Jersey may owe such a duty to non-customers.
Accordingly, the Superior Court held:
As did the bank in Patrick, Affinity established a relationship with plaintiff when it opened the account in his name with his address, date of birth, and social security number. The injury to plaintiff was foreseeable: the identity theft, the fraudulent scheme and the resulting injury and the harm it cause plaintiff were foreseeable. The depositing and cashing of worthless checks would be a likely result of an imposter opening a checking account."
Nonetheless, the Superior Court then purported to limit this legal duty of care to fraud investigations and resultant complaints. The Superior Court stated:
We need not go as far as the Patrick court, which held that the bank could be held liable for the negligent opening of accounts. Here, we do no more than hold that Affinity and Wilcox may be held liable for initiating the criminal complaints against plaintiff based upon the negligent investigation of the fraud perpetrated on the bank by the imposter.
However, two sentences later the Superior Court may have left the legal duty door open by again referencing a general "duty to exercise reasonable care in opening accounts." The Court's full statement follows:
Financial institutions - particularly banks - have a duty to exercise reasonable care in opening accounts. A duty of care extends to investigating fraud and pursuing allegedly fraudulent claims. Here, Affinity, through its employee, Wilcox - a certified fraud investigator - pursued plaintiff in the face of numerous indicators that he was not the perpetrator of the fraud.
Thus, the Superior Court found that the bank and its examiner "had a duty of care to plaintiff." The Court found that that specific "duty included the duty to conduct a reasonable investigation before initiating criminal proceedings against the person whose stolen identity was used to open the account."
Finally, in a somewhat ironic twist at the end of its decision, the Superior Court rejected the trial court's ruling requiring Brunson to be present during trial, holding that, "[a]s long as the proofs can be presented in accordance with the rules of evidence, plaintiff need not be present at trial." Alas, it seems that Brunson was in jail at the time of trial on other charges in another state and was unable to travel to New Jersey for his case.
This article was prepared by Andrew Stutzman for online publication as part of the library of LexisNexis Expert Commentaries available on Lexis.com. Expert Commentaries are authoritative analyses of important cases, codes, statutes, rulings, emerging issues, or legal topics of general interest authored by leading practice area experts.They are available as links from the cases and other primary source material they address, as well as in a searchable group file under Search; By Source; Secondary Legal; Emerging Issues Analysis on Lexis.com. Reproduced with permission. ©2008 by Matthew Bender & Co., Inc., A Member of the LexisNexis Group. All rights reserved.
Published January 1, 2009.
